diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-08-28 10:53:42 +0100 |
|---|---|---|
| committer | Michael Stahl <Michael.Stahl@cib.de> | 2019-08-01 15:32:40 +0200 |
| commit | 8e7e8929eab95d8692b46b62768f76233b605519 (patch) | |
| tree | c528f0dc0723cd5fe3409f723f5ef667b3b646c0 /filter | |
| parent | 02a2eaf63b291c63d1882c3dbab89d7927a90c08 (diff) | |
ofz#3121 check bounds better
Change-Id: Ib1eacda7e4cdf1d0238532f4e38059a9c30556ac
Reviewed-on: https://gerrit.libreoffice.org/41627
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Michael Stahl <mstahl@redhat.com>
(cherry picked from commit 2f252e0cc62b7cf9d35ba1a427a3c0b4606cd0d1)
Diffstat (limited to 'filter')
| -rw-r--r-- | filter/source/graphicfilter/icgm/class4.cxx | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/filter/source/graphicfilter/icgm/class4.cxx b/filter/source/graphicfilter/icgm/class4.cxx index ff574c4eece4..e97781d314e7 100644 --- a/filter/source/graphicfilter/icgm/class4.cxx +++ b/filter/source/graphicfilter/icgm/class4.cxx @@ -186,7 +186,7 @@ void CGM::ImplDoClass4() sal_uInt32 nType = ImplGetUI16( 4 ); sal_uInt32 nSize = ImplGetUI( 1 ); - if (static_cast<sal_uIntPtr>(mpEndValidSource - (mpSource + mnParaSize)) < nSize) + if (static_cast<sal_uIntPtr>(mpEndValidSource - (mpSource + mnParaSize)) <= nSize) throw css::uno::Exception("attempt to read past end of input", nullptr); mpSource[mnParaSize + nSize] = 0; @@ -224,7 +224,7 @@ void CGM::ImplDoClass4() sal_uInt32 nType = ImplGetUI16(4); sal_uInt32 nSize = ImplGetUI(1); - if (static_cast<sal_uIntPtr>(mpEndValidSource - (mpSource + mnParaSize)) < nSize) + if (static_cast<sal_uIntPtr>(mpEndValidSource - (mpSource + mnParaSize)) <= nSize) throw css::uno::Exception("attempt to read past end of input", nullptr); mpSource[ mnParaSize + nSize ] = 0; @@ -242,7 +242,7 @@ void CGM::ImplDoClass4() sal_uInt32 nType = ImplGetUI16( 4 ); sal_uInt32 nSize = ImplGetUI( 1 ); - if (static_cast<sal_uIntPtr>(mpEndValidSource - (mpSource + mnParaSize)) < nSize) + if (static_cast<sal_uIntPtr>(mpEndValidSource - (mpSource + mnParaSize)) <= nSize) throw css::uno::Exception("attempt to read past end of input", nullptr); mpSource[ mnParaSize + nSize ] = 0; |